linux-kernel - Re: Building signed debs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 12 Dec 2023 03:15:31 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     Tom Cook <tom.k.cook@...il.com>
Cc:     linux-modules <linux-modules@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: Building signed debs

On Mon, Dec 11, 2023 at 7:19 PM Tom Cook <tom.k.cook@...il.com> wrote:
>
> On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@...nel.org> wrote:
> > On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@...il.com> wrote:
> > >
> > > I'm trying to build a signed .deb kernel package of
> > > https://github.com/torvalds/linux/tree/v6.6.  I've copied
> > > certs/default_x509.genkey to certs/x509.genkey.  The .config is the
> > > one from Ubuntu 23.10's default kernel with all new options accepted
> > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > > CONFIG_SYSTEM_REVOCATION_KEYS="".
> > >
> > > This builds the kernel and modules, signs the modules, compresses the
> > > modules and then attempts to sign the modules again.  That fails,
> > > because the .ko module files are now .ko.zst files and the file it's
> > > trying to sign isn't there.  Full failure is pasted below.
> >
> >
> >
> > Modules are signed before the compression.
>
> Reading back through my earlier email, I wasn't clear that when I said "This
> builds the kernel..." I meant "`make deb-pkg` builds the kernel".  I'm not
> doing anything outlandish here, I think, just expecting the build system to
> work.
>
> Regards,
> Tom


OK, I understood.



The error is caused by the following lines
in scripts/package/builddeb:


# re-sign stripped modules
if is_enabled CONFIG_MODULE_SIG_ALL; then
        ${MAKE} -f ${srctree}/Makefile
INSTALL_MOD_PATH="${image_pdir}" modules_sign
fi



The error happens when all of the following three
are enabled.

 - CONFIG_DEBUG_INFO
 - CONFIG_MODULE_SIG_ALL
 - CONFIG_MODULE_COMPRESS_*


If you disable one of them, you can do deb-pkg.







-- 
Best Regards
Masahiro Yamada